Is Your Organisation BOM-Ready? How O3 Security's Complete BOM Suite Satisfies SEBI, CERT-In & RBI Requirements

India's regulatory landscape for software security has moved quickly. CERT-In's Technical Guidelines encourage government, public sector and essential services organisations to treat Bill of Materials management as standard practice. SEBI's CSCRF mandates software supply chain transparency for all Regulated Entities. RBI's IT governance framework has tightened cyber security requirements for banks and NBFCs. And for organisations that had assumed "SBOM" was a niche developer concern, the message is now unambiguous: BOM compliance is a board-level risk issue.

The challenge? Most organisations don't even know all the BOMs they're required to produce - let alone have the tools to generate them. This guide explains exactly what's required, and how O3 Security's BOM Management Suite makes compliance achievable.

The Six Bills of Materials Behind India's BOM Compliance Landscape

When most people hear "BOM compliance," they think of SBOM - the Software Bill of Materials. But India's regulatory framework is considerably broader. CERT-In's Technical Guidelines cover five distinct BOM types - SBOM, QBOM, CBOM, AIBOM and HBOM - and SEBI's CSCRF separately mandates SBOM for Regulated Entities. Industry practice adds a sixth, the SaaS Bill of Materials:

CERT-In's 21 Minimum SBOM Data Fields - What's Required

CERT-In's Technical Guidelines on SBOM, QBOM & CBOM, AIBOM and HBOM (Version 2.0, dated 9 July 2025) list 21 data fields as the minimum information that should be tracked for each software component, kept accurate and continuously updated:

• Identity attributes: Component Name, Component Version, Component Description, Unique Identifier
• Supply chain attributes: Supplier, Component Origin, Author of SBOM Data
• Dependency attributes: Component Dependencies, Structured Property, Checksums or Hashes
• Risk attributes: Vulnerabilities, Patch Status, Criticality, Usage Restrictions
• Lifecycle attributes: Release Date, End-of-Life Date, Timestamp, Archive Property
• Legal attributes: Component License, Executable Property, Comments/Notes

SEBI CSCRF - What It Means for Your Software Supply Chain

SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) for Regulated Entities was issued on 20 August 2024. The framework requires that financial market participants maintain visibility into software components used in critical financial applications - a requirement that directly mandates SBOM capabilities.

Under Clause GV.SC.S5 of the CSCRF, all Regulated Entities must obtain SBOMs for their existing critical systems within six months of the framework's issuance, and for any new critical systems software or Software-as-a-Service products at the time of procurement. Market Infrastructure Institutions must also include SBOM as part of their empanelment criteria for application software vendors. The SBOM itself must record, among other things, licence information, the supplier's name, all primary components with their transitive dependencies, encryption used, cryptographic hashes and the frequency of updates.

The CBOM Imperative: Why Cryptographic Governance Is Urgent

The CBOM requirement is new for most Indian organisations. A Cryptographic Bill of Materials inventories cryptographic assets in an environment - algorithms, keys, certificates and protocols in use. O3 Security states that its CBOM capability discovers cryptographic algorithms, key sizes and protocols across an organisation's environment.

Why is this urgent? Two reasons. First, CERT-In and RBI expect organisations to demonstrate that their cryptographic implementations meet current security standards - meaning you need to know which systems are using deprecated algorithms (MD5, SHA-1, DES, RSA-1024, TLS 1.0/1.1). Second, quantum computers running Shor's Algorithm will break RSA and ECC - the algorithms protecting most financial transactions today. The NIST post-quantum standards are now finalised. India's financial sector needs a migration plan, and that plan starts with a CBOM.

AIBOM: The New Frontier of Regulatory Transparency

As Indian financial institutions deploy AI-powered fraud detection, credit scoring, and customer service systems, CERT-In's AIBOM requirements become directly relevant. An AI Bill of Materials inventories AI models, training datasets, software dependencies, hardware requirements, and known vulnerabilities. CERT-In's guidelines state that AI solutions supplied to government, public sector and essential services organisations must be accompanied by an AIBOM detailing these components and dependencies.

How O3 Security Makes BOM Compliance Achievable

O3 Security generates all six BOM types - SBOM, CBOM, QBOM, AIBOM, HBOM, and SaaSBOM - in a unified platform. It describes its SaaS offering as a MeitY-empanelled, India-hosted cloud with data residing locally, and also offers on-premises, hybrid and air-gapped deployment for organisations that need to keep data off the public cloud.

The platform integrates directly with your CI/CD pipelines and source code repositories, generating SBOMs automatically on every build - in both SPDX and CycloneDX formats. For CERT-In audits, O3 Security generates on-demand compliance evidence packages that address the 21 minimum SBOM data fields and the related operational requirements. For SEBI CSCRF audits, the platform produces supply chain risk reports that demonstrate your vulnerability management programme to regulators.

Deployment Options That Meet Every Regulatory Requirement

O3 Security offers four deployment models: SaaS (MeitY-empaneled, India-hosted cloud), On-Premises (full data control, local keys, offline validation), Hybrid (separate data and analytics planes), and Air-Gapped (zero network footprint, for defence and critical infrastructure). All four models offer full feature parity - no capability is reserved for one deployment mode.

The message from Indian regulators is clear: BOM management is no longer a niche concern. SEBI has made SBOM mandatory for Regulated Entities under its CSCRF, and CERT-In encourages government, public sector and essential services organisations to adopt SBOM, QBOM, CBOM, AIBOM and HBOM as standard practice. Organisations that begin their BOM programme now will have clean audit evidence, time to address compliance gaps methodically, and a competitive advantage in regulated procurement processes. Organisations that wait will face emergency compliance programmes and compressed timelines. O3 Security makes starting easy - and makes compliance sustainable.

Sources

Primary documents this article is based on. Product statements and regulatory clauses above were checked against these pages.

• CERT-In Technical Guidelines on SBOM, QBOM & CBOM, AIBOM and HBOM v2.0 (PDF)
• SEBI CSCRF circular (20 Aug 2024)
• SEBI CSCRF full document (PDF)
• RBI Master Direction - IT Governance, Risk, Controls and Assurance Practices, 2023
• RBI Cyber Security Framework in Banks (2016)
• CycloneDX
• SPDX
• NIST post-quantum cryptography FIPS approval
• O3 Security (official site)
• O3 Security - CERT-In/SEBI/RBI compliance tool page
• O3 Security - CERT-In SBOM/QBOM/CBOM/AIBOM/HBOM guidelines page